> JapanHacked_
[Investigating][Severity: Major][Ransomware]

Japan Marine Equipment Inspection Association: an attack that looks like REvil ransomware took down all systems, mail included

The government-registered inspection body was hit by ransomware. The attackers posted a screenshot of its files on the dark web and demanded a ransom, which it refused.

Disclosed

2020-08-04

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. An outside tip alerted the association. Its business servers had been infected with what appeared to be ransomware. The attackers had posted a screenshot of a folder on what seemed to be the association's PC on the dark web and were demanding a ransom. The association said it would not pay. [1] [2] [3]

  2. Public disclosure; all systems, including mail, were unusable. [3]

Impact

The ransomware appeared to be REvil, also known as Sodinokibi. At the time of the notice, no data leak had been confirmed. [1] [3]

Timeline

  1. Detected, Disclosed 2020-08-04
  2. 1 days

Attack or cause

Method
[Ransomware]
Impact
[Service outage][Extortion]
Entry point
Unknown

Data exposed or at risk

–

Organizations involved

Open in organization search

Sources

  1. [1][News]船舶用品の検査機関、標的型のランサムウエアに感染かNikkei xTECH · 2020-08-04
  2. [2][News]船舶用品の検査機関、標的型ランサムウエアに感染かNikkei · 2020-08-05 17:45
  3. [3][News]業務用サーバがランサムウェアに感染、全システム使用不能に（日本舶用品検定協会）ScanNetSecurity · 2020-08-17 08:05